Dosfuscated Scripts

1. Introduction

Obfuscation refers to various techniques for modifying the source code of a program in such a way that it is difficult for analysts to analyze it. The effort required for reverse-engineering a malware thus increases significantly. In addition, the malicious code cannot be detected as easily by automated analysis. To obfuscate code, for example, individual letters can be replaced by others, and individual components of a program or files can be encrypted.

Attackers often use Obfuscation framewoks to hide their maliscious cmd or powershell payloads.

I've discovered a really cool IT-Security blog which shows us obfuscated examples and howto decode them:

Deobfuscating DOSfuscated Scripts | Kahu Security

2. Deobfuscation Tips

• Replace "CMD" and "PowerShell" verbs (could be obfuscated) at the end with "echo"

• Find the final variable that holds the deobfuscated content then replace the execution verb with "echo" or "set"

• If you use "set" then get rid of the percent signs (%) before and after the variable name

• A variable name could contain spaces, or more specifically, end with a space so cleaning up the script or extracting the variable name with too little or too much spaces will likely result in failure

• Sometimes you can delete everything after the pipe (|) (but if the script has a double-quote at the end then be sure you keep it)

• Change "call" to "echo" then reference the previously assigned variable with surrounding quotes (!var!)

3. Examples

At the bottom is a "DO %b /c %wZ%". The "DO %b" is "cmd /c" and "%wZ%" is the variable we want to see the contents of. So you just make the change you see

If you paste this to the CMD prompt and let it run you can see that the deobfuscated content is "net user".

Here's one example where you can delete everything after the pipe which is near the end of the script.

The result is shown at the very bottom.

Here's a reversed script where you can replace the "%TMP:~-8 ... -12,+1%" at the end with "echo".

And "net user" is the result.

In this example, you can replace the "call" at the end with "echo" and then you get the variable to the left of the equal sign. Look for the double-exclamation marks and take one of them.

The result is "net user" again.

In this last example, you can replace "echo" with "set" and remove the percent signs at the beginning and end. Do also remove the pipe up to the closest parenthesis.

And get this result.